PT-2026-22092 · WordPress+1 · Livemesh Addons For Beaver Builder+1

Dj + 1 · Publicado 2026-02-26 · Atualizado 2026-02-26 · CVE-2026-2029

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Livemesh Addons for Beaver Builder versions up to and including 3.9.2

Description The Livemesh Addons for Beaver Builder plugin for WordPress contains a Stored Cross-Site Scripting issue. The issue is due to insufficient input sanitization and output escaping in the [labb pricing item] shortcode’s title and value attributes. The plugin uses htmlspecialchars decode() after wp kses post(), which re-encodes HTML entities into executable code after sanitization. This allows authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages. These scripts will then execute when a user accesses the compromised page.

Recommendations Update Livemesh Addons for Beaver Builder to a version beyond 3.9.2.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-2029

Produtos afetados

Beaver Builder

Livemesh Addons For Beaver Builder

Referências · 7

• https://twitter.com/VulmonFeeds/status/2026949946767770108 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/8bc96b4f-256e-491b-9d27-de1adbf67643?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/addons-for-beaver-builder/tags/3.9.2/includes/modules/labb-pricing-table/labb-pricing-table.php#L51 · Nota
• https://t.me/CVEtracker/45815 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-2029 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/addons-for-beaver-builder/tags/3.9.2/includes/modules/labb-pricing-table/labb-pricing-table.php#L59 · Nota
• https://twitter.com/CVEnew/status/2027004220876927139 · Publicação no Twitter